312-85 Practice Test 7 — 10 Questions

Question 1

What is the primary purpose of the 'Actions on Objectives' phase in the Cyber Kill Chain?

Accepted Answer

Data Exfiltration. This is the final phase where the adversary achieves their ultimate goal, such as data exfiltration or system destruction.

Answer

Reconnaissance of the target

Answer

Establishing a backdoor

Answer

Sending phishing emails

Question 2

You are reviewing a threat intelligence report that includes a list of indicators. You notice that one indicator is an IP address with a low confidence score. According to best practices, what should you do before using this indicator for detection?

Accepted Answer

Correlate the indicator with other sources to increase confidence.. Before using a low-confidence indicator, analysts should correlate it with other sources to validate its maliciousness and increase confidence. This step reduces false positives and ensures that any subsequent actions, such as blocking, are justified. It is a core practice in threat intelligence to avoid acting on unverified data.

Answer

Discard the indicator because it is not reliable.

Answer

Immediately block the IP address at the firewall.

Answer

Add the indicator to a watchlist for manual review only.

Question 3

A security operations center analyst is mapping an intrusion to the MITRE ATT&CK framework. The analyst observes that after gaining initial access, the adversary used Windows Management Instrumentation (WMI) to remotely create processes on other hosts in the domain. Under which ATT&CK tactic does this activity fall?

Accepted Answer

Lateral Movement. Using WMI to create processes on remote hosts allows an adversary to pivot from one compromised system to others within the domain, which is the definition of Lateral Movement in MITRE ATT&CK. The technique is catalogued as Windows Management Instrumentation (T1047) and is frequently observed because it abuses a legitimate administrative feature, making it harder to distinguish from normal management activity.

Answer

Privilege Escalation

Answer

Execution

Answer

Persistence

Question 4

A threat intelligence team is correlating indicators from multiple feeds. They observe that a set of domain names resolves to fast-flux IP addresses, the domains were registered within the last 48 hours, and the same SSL certificate serial number appears across several unrelated domains. Which analytic conclusion is best supported by this evidence?

Accepted Answer

The infrastructure is likely adversary-controlled and may be used for malware command-and-control or phishing.. The convergence of fast-flux DNS, newly registered domains, and shared certificate serials across unrelated domains is a recognized pattern of adversary-controlled infrastructure. Each indicator alone can have benign explanations, but together they strongly suggest malicious intent. The analyst should treat these domains as suspicious, enrich them with passive DNS and WHOIS data, and consider blocking or monitoring while continuing to validate the assessment.

Answer

The domains are part of a legitimate content delivery network with high availability requirements.

Answer

The domains are compromised legitimate sites being used as watering holes.

Answer

The shared certificate serial number proves the domains are owned by a single legitimate organization.

Question 5

A threat intelligence analyst is reviewing a report that describes an adversary's operational approach using a model that maps phases from reconnaissance through to achieving the final mission. The report specifically highlights that the adversary spent weeks performing open-source research on employees and technical infrastructure before any exploitation attempt. In the Lockheed Martin Cyber Kill Chain, which phase is being described?

Accepted Answer

Reconnaissance. Reconnaissance is the correct phase because the adversary is conducting open-source research on employees and technical infrastructure before any exploitation attempt. This phase encompasses all information gathering activities that precede weaponization and delivery. The scenario contains no evidence of payload creation, transmission, or vulnerability exploitation, so the other phases are not applicable.

Answer

Exploitation

Answer

Weaponization

Answer

Delivery

Question 6

A threat intelligence analyst is preparing to analyze a large set of intrusion artifacts collected from multiple sensors. She wants to apply structured analysis techniques to reduce bias and improve the defensibility of her conclusions. Which two techniques are most appropriate for this goal? (Choose two.)

Accepted Answer

Analysis of Competing Hypotheses to evaluate alternative explanations against evidence.. Structured analytic techniques such as Analysis of Competing Hypotheses and Key Assumptions Check are designed to reduce cognitive bias and make reasoning transparent. ACH forces consideration of alternative explanations and highlights diagnostic evidence, while a Key Assumptions Check exposes the beliefs that underpin interpretation. Together they provide a defensible, repeatable foundation for analyzing large artifact sets and communicating conclusions to decision-makers.

Answer

Devil's Advocacy to argue the opposite of the prevailing view regardless of evidence.

Answer

Timeline analysis to sequence events chronologically without assessing causality.

Answer

Brainstorming to generate as many ideas as possible without evaluating them.

Question 7

A threat hunter is investigating a suspected data exfiltration channel that uses DNS tunneling. The organization's DNS logs capture query names, query types, response codes, and source hosts, but not full packet payloads. Which TWO characteristics of the DNS queries would most reliably indicate tunneling activity rather than normal DNS behavior? (Choose two.)

Accepted Answer

Unusually long and high-entropy subdomain labels encoded in the query name.. Without payload visibility, tunneling must be inferred from query shape and type: long, high-entropy subdomain labels carry encoded data, and sustained TXT queries from one host exploit a record type and volume that normal endpoints rarely produce. Popular A-record lookups, organization-wide NXDOMAIN noise, and internal PTR queries all match benign baselines and cannot isolate a tunneling channel.

Answer

Frequent NXDOMAIN responses for typo-like domain names across the entire organization.

Answer

Queries that use the A record type for well-known public domains from many different hosts.

Answer

Periodic PTR record queries for internal RFC1918 addresses from a single host.

Question 8

A threat intelligence analyst is examining a malware sample and observes that the binary contains a hardcoded list of domain names that are contacted in a fixed order, with a fallback to a DGA-generated domain if the first three fail. The analyst wants to characterize the command-and-control resilience of this malware. Which statement best describes the resilience of this C2 approach?

Accepted Answer

The C2 is moderately resilient; the hardcoded domains are a weakness, but the DGA fallback provides some redundancy.. The malware's C2 uses a fixed hardcoded list with a DGA fallback. The hardcoded domains are a single point of failure because they can be blocked, seized, or sinkholed. The DGA fallback provides redundancy by generating many potential domains, but DGAs can be predicted and mitigated. Therefore, the design is moderately resilient, offering more redundancy than a single static domain but less than a fully decentralized or domain-fronting approach.

Answer

The C2 is not resilient at all because hardcoded domains are always taken down quickly.

Answer

The C2 is highly resilient because it uses a DGA, which cannot be taken down.

Answer

The C2 resilience cannot be assessed without knowing the encryption algorithm used for communications.

Question 9

A threat intelligence analyst is processing a large set of indicators and needs to enrich them with additional context. The analyst wants to use the MITRE ATT&CK framework to map indicators to adversary tactics, techniques, and procedures (TTPs). Which data processing step should be performed first to ensure accurate mapping?

Accepted Answer

Normalize the indicators to a standard format. Normalizing indicators to a standard format is essential before mapping to MITRE ATT&CK because it ensures that indicators are consistently represented, enabling accurate matching to techniques. Without normalization, variations in data can cause mismatches and reduce the effectiveness of enrichment. Other steps like WHOIS enrichment, SIEM correlation, or clustering are valuable but should follow normalization to maintain data integrity.

Answer

Apply machine learning clustering to group similar indicators

Answer

Correlate indicators with existing events in the SIEM

Answer

Enrich indicators with WHOIS data

Question 10

A threat intelligence analyst is collecting data from a TAXII 2.1 server. The analyst needs to retrieve only the indicators that have been added or modified since the last collection. Which TAXII 2.1 feature should be used to achieve this?

Accepted Answer

Use the 'added_after' query parameter. The 'added_after' query parameter in TAXII 2.1 is specifically designed for incremental collection, allowing clients to request objects added after a given timestamp. This efficiently retrieves only new or modified indicators, reducing bandwidth and processing. Other parameters like 'match[version]' or 'limit' serve different purposes and do not support time-based filtering for incremental updates.

Answer

Use the 'limit' query parameter to paginate results

Answer

Use the 'filter' query parameter with a date range

Answer

Use the 'match[version]' query parameter